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Amendments to the Claims : 

The listing of claims will replace all prior versions, and listings, of claims 
in the application; 

Listing of Claims : 

Claim 1. (Currently Amended) An electronic control system having at 
least first, second and third mutually communicating control units and a 
memory, wherein during for transmission of a safety rolatod tranomittod control - 
related signal from the first control unit to the second control unit: 

the first control unit generates the tranomittod control-related 
signal and a second signal complementary thereto on different paths and, sends 
them to the memory, together with two additional signals, which are indicative 
of the roopoctivoly respective different paths; 

the third control unit reads out the control-related and 
complementarv signals tranomittod and the additional signals from the memory, 
and checks them, and i) upon detection of an error in said signals , switches off 
the first control unit or, ii) if [[the]] said signals are correct, generates different 
types of test or safety signals and sends them to the memory; and 

the first control unit reads out the test or safety signals from the 
memory and checks them and, i) upon detection of an error in said test or safetv 
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related signals , switches itself off, or ii) if the test or safety signals are correct, 
foods emits the tranomittod control-related signal and at least [[one]] a 
prescribed selection of the test or safety signals , for transmission to the second 
control unit. 

Claim 2. (Currently Amended) The control system according to Claim 
1, wherein the second control unit tests the tranomittod selection of [[the]] test or 
safety signals and disregards the tranomittod control-related signal upon 
detection of an error in the selection of test or safety signals . 

Claim 3. (Currently Amended) The control system according to Claim 
1, wherein the second control unit processes or obeys the tranomittod 
control^related signal if the selection of the test or safety signals [[are]] is 
correct. 

Claim 4. (Currently Amended) The control system according to Claim 
1, wherein the second control unit returns ono of tho rocoivod tranomittod oignal 
€tiid an acknowledgment signal that is correlated to the received control-related 
signal thorowith , to the first control unit, which checks the [[fed]] 
acknowledgement signal and i) upon detection of an error in the 
acknowledgement signal , switches the control system to an emergency operating 
or standby operating mode, and ii) if the acknowledgement signal is correct, 
causes the [[fed]] control-related signal to be processed further. 
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Claim 5. (Currently Amended) The control system according to Claim 
1, wherein: 

if the test or safety signals are correct, the first control unit relays 
the tranomittod control-related signal and the selection of the test or safety 
signals to the second control unit via a data bus transmitter, which data bus 
transmitter returns the tranomittod control related signal and the selection of 
the test or safety signals to the second control unit and to the first control unit, 
respectively; and 

the first control unit compares the tranomittod control-related and 
the returned signals and turns itself off in the event of signal deviations. 

Claim 6. (Currently Amended) The control system according to claim 
1, wherein the tranomittod control-related signal and the second signal are 
complementary to one another in a bitwise fashion. 

Claim 7. (New) A method for controlling transmission of control- 
related signals between first and second control units in a distributed control 
system that includes said first and second control units, a memory and at least a 
third control unit, all of which communicate with each other via a 
communications network, said method comprising: 
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said first control unit generating a control-related signal and a 
second signal complementary thereto on different paths and, sending them to the 
memory, together with two additional signals, which are indicative of the 
respective different paths; 

said third control unit reading out the control-related and 
complementary signals and the additional signals from the memory, and 
checking them, and i) upon detection of an error in said signals, switching off the 
first control unit or, ii) if the signals are correct, generating different types of test 
or safety signals and sending them to the memory; and 

said first control unit reading out the test or safety signals from the 
memory and checking them and, i) upon detection of an error in said test or 
safety signals, switching itself off, or ii) if the test or safety signals are correct, 
emitting the control-related signal and at least a prescribed selection of the test 
or safety signals, for transmission to the second control unit. 

Claim 8. (New) The control system according to Claim 7, wherein the 
second control unit tests the selection of test or safety signals and disregards the 
control-related signal upon detection of an error in the selection of test or safety 
signals. 
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Claim 9. (New) The control system according to Claim 7, wherein the 
second control unit processes or obeys the control-related signal if the selection of 
the test or safety signals is correct. 

Claim 10. (New) The control system according to Claim 7, wherein the 
second control unit returns an acknowledgment signal that is correlated to the 
received control-related signal, to the first control unit, which checks the 
acknowledgement signal and i) upon detection of an error in the 
acknowledgement signal, switches the control system to an emergency operating 
or standby operating mode, and ii) if the acknowledgement signal is correct, 
causes the control-related signal to be processed further. 

Claim 11. (New) The control system according to Claim 7, wherein: 

if the test or safety signals are correct, the first control unit relays 
the control-related signal and the selection of the test or safety signals to the 
second control unit via a data bus transmitter, which data bus transmitter 
returns the control related signal and the selection of the test or safety signals to 
the second control unit and to the first control unit, respectively; and 

the first control unit compares the control-related and the returned 
signals and turns itself off in the event of signal deviations. 
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Claim 12. (New) The control system according to claim 7, wherein the 
control-related signal and the second signal are complementary to one another in 
a bitwise fashion. 
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